CVE-2026-46516

Description

Frogman provides headless FreePBX control. Prior to version 1.6.6, Frogman-s chat-console markdown formatter (`assets/js/chat.js`-s `formatMarkdown`) inserted regex capture groups as raw HTML in four template patterns: inline code, bold, markdown links, and download links. Tool responses that reflect user-controlled fields — extension names, ring-group descriptions, IVR names, queue descriptions, etc. — could carry an HTML/JavaScript payload that executes when another admin views the response through Frogman chat. The payload runs in the viewer-s session, with the viewer-s permissions. FreePBX-s own admin GUI escapes these same fields via `freepbx_htmlspecialchars()` throughout its view templates. The chat formatter was the leaky side. Version 1.6.6 patches the issue.